vibecarbon 0.10.0 → 0.11.0

package/src/lib/deploy/tier-registry.js

@@ -0,0 +1,30 @@
+/**
+ * Canonical tier taxonomy. Config persists deployMode ('compose' | 'compose-ha'
+ * | 'kubernetes') plus an ha flag ('kubernetes-ha' is normalized away at
+ * prompt time, see prompts.js). Everything downstream should dispatch on the
+ * tier id returned here instead of re-deriving mode+ha combinations.
+ */
+export const TIERS = ['compose', 'compose-ha', 'k8s', 'k8s-ha'];
+
+export function resolveTier(envConfig = {}) {
+  const { deployMode, ha } = envConfig;
+  const haEnabled = typeof ha === 'object' ? !!ha?.enabled : !!ha;
+  switch (deployMode) {
+    case 'compose':
+      return 'compose';
+    case 'compose-ha':
+      return 'compose-ha';
+    case 'kubernetes':
+      return haEnabled ? 'k8s-ha' : 'k8s';
+    default:
+      throw new Error(`Unknown deployMode: ${JSON.stringify(deployMode)}`);
+  }
+}
+
+export const isHATier = (tier) => tier === 'compose-ha' || tier === 'k8s-ha';
+export const isComposeTier = (tier) => tier === 'compose' || tier === 'compose-ha';
+export const isK8sTier = (tier) => tier === 'k8s' || tier === 'k8s-ha';
+
+export function pulumiStackEnvs(tier, environment) {
+  return tier === 'k8s-ha' ? [`${environment}-primary`, `${environment}-standby`] : [environment];
+}

package/src/lib/retry.js

@@ -0,0 +1,59 @@
+/**
+ * Shared retry/polling primitives for the exec layer.
+ *
+ * Two shapes cover every bespoke loop in the codebase:
+ *  - runWithRetry: N attempts with explicit inter-attempt delays
+ *    (kubectl transient retries, ssh transient retries, sideload/push settles).
+ *  - pollUntil: probe under a time budget with capped exponential backoff
+ *    (wait-for-k3s, wait-for-schema, wait-for-API-healthy, delete-until-404).
+ */
+import { setTimeout as sleep } from 'node:timers/promises';
+
+export async function runWithRetry(
+  fn,
+  { delaysMs = [5000, 5000], isTransient = () => true, onRetry } = {},
+) {
+  let attempt = 0;
+  // attempts = delaysMs.length + 1
+  for (;;) {
+    try {
+      return await fn(attempt);
+    } catch (err) {
+      if (attempt >= delaysMs.length || !isTransient(err)) throw err;
+      attempt += 1;
+      if (onRetry) onRetry(err, attempt);
+      await sleep(delaysMs[attempt - 1]);
+    }
+  }
+}
+
+export async function pollUntil(
+  probe,
+  {
+    budgetMs,
+    initialDelayMs = 2000,
+    maxDelayMs = 15_000,
+    backoffFactor = 2,
+    description = 'condition',
+  } = {},
+) {
+  const deadline = Date.now() + budgetMs;
+  let delay = initialDelayMs;
+  let lastErr;
+  for (;;) {
+    try {
+      const result = await probe();
+      if (result) return result;
+      lastErr = undefined;
+    } catch (err) {
+      lastErr = err;
+    }
+    if (Date.now() + delay > deadline) break;
+    await sleep(delay);
+    delay = Math.min(delay * backoffFactor, maxDelayMs);
+  }
+  const cause = lastErr ? `: ${lastErr.message}` : '';
+  const err = new Error(`Timed out after ${budgetMs}ms waiting for ${description}${cause}`);
+  err.cause = lastErr;
+  throw err;
+}

package/src/lib/scale-plan.js

@@ -0,0 +1,159 @@
+/**
+ * Pure planning helpers for `vibecarbon scale` (k8s / k8s-ha).
+ *
+ * These functions carry NO side effects — no clack prompts, no SSH, no fetch,
+ * no Pulumi. They translate parsed flags and resolved config into the plain
+ * data shapes the orchestration code in src/scale.js consumes, which keeps the
+ * two behaviors that matter most testable in isolation:
+ *
+ *   - the non-interactive `-yes`/`-type`/bounds flag matrix, and
+ *   - the Pulumi programConfig assembly, whose output MUST stay byte-identical
+ *     to what `deploy` produced or Pulumi plans a destructive replace of every
+ *     node (etcd loss). See the extensive comments at the call site.
+ */
+import { DEFAULT_WORKER_MAX, DEFAULT_WORKER_MIN } from './deploy/utils.js';
+
+const REGION_TO_NETWORK_ZONE = {
+  nbg1: 'eu-central',
+  hel1: 'eu-central',
+  fsn1: 'eu-central',
+  hil: 'us-west',
+  ash: 'us-east',
+  sin: 'ap-southeast',
+};
+
+/**
+ * Resolve the non-interactive scale plan from parsed flags.
+ *
+ * Returns `{ changes, newValues }` for the two scripted branches:
+ *   - `-yes -type X`  → resize every node role to X (plus workerBounds when
+ *     --min/--max are also present).
+ *   - `-yes` + bounds → cluster-autoscaler bounds only.
+ * Returns `null` when neither branch matches, signalling the caller to fall
+ * back to the interactive multiselect prompt.
+ *
+ * `changes[]` elements are the string ids the caller dispatches on:
+ * 'masterType' | 'supabaseType' | 'workerType' | 'workerBounds'.
+ *
+ * envConfig is accepted for signature parity with the interactive caller; the
+ * non-interactive branches are a pure function of `parsed`.
+ *
+ * @param {{ yes?: boolean, type?: string|null, minWorkers?: number|null, maxWorkers?: number|null }} parsed
+ * @param {object} envConfig
+ * @returns {{ changes: string[], newValues: Record<string, unknown> } | null}
+ */
+export function planK8sScaleChanges(parsed, _envConfig) {
+  const newValues = {};
+
+  if (parsed.yes && parsed.type) {
+    // `--type X` means "scale every node role to X" for parity with compose's
+    // `--type X` (which resizes the one VPS).
+    const changes = ['masterType', 'supabaseType', 'workerType'];
+    newValues.masterType = parsed.type;
+    newValues.supabaseType = parsed.type;
+    newValues.workerType = parsed.type;
+    // Allow --type and bounds to be combined in one invocation.
+    if (parsed.minWorkers != null || parsed.maxWorkers != null) {
+      changes.push('workerBounds');
+      if (parsed.minWorkers != null) newValues.minWorkers = parsed.minWorkers;
+      if (parsed.maxWorkers != null) newValues.maxWorkers = parsed.maxWorkers;
+    }
+    return { changes, newValues };
+  }
+
+  if (parsed.yes && (parsed.minWorkers != null || parsed.maxWorkers != null)) {
+    // Bounds-only path: --min-workers and/or --max-workers without --type.
+    const changes = ['workerBounds'];
+    if (parsed.minWorkers != null) newValues.minWorkers = parsed.minWorkers;
+    if (parsed.maxWorkers != null) newValues.maxWorkers = parsed.maxWorkers;
+    return { changes, newValues };
+  }
+
+  return null;
+}
+
+/**
+ * Assemble the Hetzner-k8s Pulumi programConfig. Its output MUST be
+ * byte-identical to what deployK3s passed at deploy time — every field that
+ * flows into a Server's `sshKeys`, `firewallIds`, `labels`, or `userData` is a
+ * tripwire for a destructive replace, and replacing master wipes etcd.
+ *
+ * @param {object} inputs
+ * @param {string} inputs.projectName
+ * @param {string} inputs.environment          Cluster env (e.g. `prod`, `prod-primary`).
+ * @param {string} inputs.sshPublicKey
+ * @param {string[]} inputs.allowedCidrs        Operator CIDRs (SSH + k8s API).
+ * @param {string|undefined} inputs.existingSshKeyId
+ * @param {string} inputs.location              Cluster region.
+ * @param {Record<string, unknown>} inputs.newValues   Plan output; may set *Type/*Workers.
+ * @param {string} inputs.currentMasterType
+ * @param {string} inputs.currentSupabaseType
+ * @param {string} inputs.currentWorkerType
+ * @param {number|undefined} inputs.persistedMinWorkers   envConfig.minWorkers
+ * @param {number|undefined} inputs.persistedMaxWorkers   envConfig.maxWorkers
+ * @param {string} inputs.k3sVersion
+ * @param {Record<string, string>} inputs.labels
+ * @param {string} inputs.apiToken
+ * @returns {object}
+ */
+export function buildProgramConfig({
+  projectName,
+  environment,
+  sshPublicKey,
+  allowedCidrs,
+  existingSshKeyId,
+  location,
+  newValues,
+  currentMasterType,
+  currentSupabaseType,
+  currentWorkerType,
+  persistedMinWorkers,
+  persistedMaxWorkers,
+  k3sVersion,
+  labels,
+  apiToken,
+}) {
+  return {
+    projectName,
+    environment,
+    sshPublicKey,
+    allowedSshIps: allowedCidrs,
+    allowedK8sApiIps: allowedCidrs,
+    // HA deploys share one Hetzner SshKey across primary + standby and pass
+    // `existingSshKeyId` so neither stack manages the resource. Single-cluster
+    // lets Pulumi own the SshKey (existingSshKeyId = undefined).
+    existingSshKeyId,
+    location,
+    networkZone: REGION_TO_NETWORK_ZONE[location] || 'eu-central',
+    masterServerType: newValues.masterType ?? currentMasterType,
+    supabaseServerType: newValues.supabaseType ?? currentSupabaseType,
+    workerServerType: newValues.workerType ?? currentWorkerType,
+    // minWorkers is Pulumi's static worker floor; maxWorkers flows to the CA
+    // patch (not consumed by Pulumi). Replay persisted values when the operator
+    // didn't override, keeping Pulumi's worker-pool plan a no-op.
+    minWorkers: newValues.minWorkers ?? persistedMinWorkers ?? DEFAULT_WORKER_MIN,
+    maxWorkers: newValues.maxWorkers ?? persistedMaxWorkers ?? DEFAULT_WORKER_MAX,
+    k3sVersion,
+    labels,
+    apiToken,
+  };
+}
+
+/**
+ * Rewrite the cluster-autoscaler container's `--nodes=` arg to a freshly
+ * formatted spec, preserving every other arg. Appends the flag if the deploy
+ * container somehow shipped without it. Pure list transform.
+ *
+ * @param {string[]} argList  Current container args (from kubectl jsonpath).
+ * @param {string} caNodesSpec  New `<min>:<max>:<type>:<region>:<pool>` spec.
+ * @returns {string[]}
+ */
+export function updateCaNodesArgs(argList, caNodesSpec) {
+  const updated = (Array.isArray(argList) ? argList : []).map((a) =>
+    typeof a === 'string' && a.startsWith('--nodes=') ? `--nodes=${caNodesSpec}` : a,
+  );
+  if (!updated.some((a) => typeof a === 'string' && a.startsWith('--nodes='))) {
+    updated.push(`--nodes=${caNodesSpec}`);
+  }
+  return updated;
+}

package/src/scale.js

@@ -38,6 +38,7 @@ import {
   waitForSSH,
 } from './lib/deploy/compose/index.js';
 import { buildRemote } from './lib/deploy/remote-build.js';
+import { isHATier, resolveTier } from './lib/deploy/tier-registry.js';
 import { DEFAULT_WORKER_MAX, DEFAULT_WORKER_MIN } from './lib/deploy/utils.js';
 import { waitForDNSPropagation } from './lib/dns-propagation.js';
 import { getApiToken, getS3Credentials } from './lib/hetzner-guided-setup.js';
@@ -45,6 +46,8 @@ import { ensureOperatorIpAccess } from './lib/operator-ip.js';
 import { perfAsync } from './lib/perf.js';
 import { assertInProjectDir } from './lib/project-guard.js';
 import { HETZNER_PRICING_URL, HetznerProvider } from './lib/providers/hetzner.js';
+import { pollUntil } from './lib/retry.js';
+import { buildProgramConfig, planK8sScaleChanges, updateCaNodesArgs } from './lib/scale-plan.js';
 import { buildComposeTypeOptions, buildSimpleTypeOptions } from './lib/server-types.js';
 import { parseDotenv } from './lib/shell.js';
 import { sshRun, sshRunScript } from './lib/ssh.js';
@@ -98,6 +101,7 @@ const SPEC = {
 // ============================================================================
 
 async function scaleCompose(environment, envConfig, projectConfig, options = {}) {
+  const tier = options.tier || resolveTier(envConfig);
   const servers = envConfig.servers || [];
   const projectName = projectConfig.projectName;
 
@@ -131,7 +135,7 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
 
   // Ensure operator IP is in the firewall allowlist before any SSH work.
   try {
-    const isHA = envConfig.deployMode === 'compose-ha';
+    const isHA = isHATier(tier);
     const result = await ensureOperatorIpAccess({
       projectConfig,
       environment,
@@ -174,7 +178,7 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
 
   // For compose-ha: select which server(s) to scale
   let targetServers = resizableServers;
-  if (envConfig.deployMode === 'compose-ha' && resizableServers.length > 1) {
+  if (isHATier(tier) && resizableServers.length > 1) {
     const primaryServer = resizableServers.find((s) => s.role === 'primary');
     const standbyServer = resizableServers.find((s) => s.role === 'standby');
 
@@ -232,7 +236,7 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
     return;
   }
 
-  const ha = envConfig.deployMode === 'compose-ha';
+  const ha = isHATier(tier);
   const services = projectConfig.services || {};
   p.note(`Current Hetzner pricing: ${HETZNER_PRICING_URL}`, 'Cost');
 
@@ -288,8 +292,7 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
   // exactly 2× single-server scale (711s vs ~365s); parallelizing makes it
   // ~max(primary, standby) ≈ 6m off the critical path.
   const scaleSingleServer = async (server) => {
-    const label =
-      envConfig.deployMode === 'compose-ha' ? `${server.role} (${server.ip})` : server.ip;
+    const label = isHATier(tier) ? `${server.role} (${server.ip})` : server.ip;
     const s = p.spinner();
 
     // 1. Backup database on old server via wal-g (pushes directly to S3)
@@ -739,6 +742,17 @@ async function updateDNS(envConfig, apiToken, domain, newIp) {
 // MAIN
 // ============================================================================
 
+// Tier → scale strategy. scaleCompose / scaleK8s are hoisted function
+// declarations, so referencing them here at module scope is safe. Compose and
+// compose-ha share one strategy (it branches on isHATier internally); likewise
+// k8s / k8s-ha.
+const SCALE_STRATEGIES = {
+  compose: scaleCompose,
+  'compose-ha': scaleCompose,
+  k8s: scaleK8s,
+  'k8s-ha': scaleK8s,
+};
+
 export async function run(args) {
   const { values, positional, errors } = parseFlags(args, SPEC);
 
@@ -829,15 +843,18 @@ export async function run(args) {
     process.exit(1);
   }
 
-  // Compose deployments: vertical scaling via Hetzner API
-  if (envConfig.deployMode === 'compose' || envConfig.deployMode === 'compose-ha') {
-    await scaleCompose(environment, envConfig, projectConfig, {
-      type: parsed.type,
-      yes: parsed.yes,
-    });
-    return;
-  }
+  // Dispatch to the tier's scale strategy. The 4th arg carries the parsed
+  // flags plus the resolved `tier` so each strategy dispatches on tier /
+  // isHATier(tier) instead of re-deriving deployMode+ha.
+  const tier = resolveTier(envConfig);
+  await SCALE_STRATEGIES[tier](environment, envConfig, projectConfig, { ...parsed, tier });
+}
+
+// ============================================================================
+// KUBERNETES SCALING
+// ============================================================================
 
+async function scaleK8s(environment, envConfig, projectConfig, parsed) {
   const region = envConfig.region || 'fsn1';
 
   // Pre-fetch live server types (non-blocking, uses saved credentials if available)
@@ -882,60 +899,28 @@ export async function run(args) {
   const regionTypes = HetznerProvider.getServerTypesForRegion(region);
   const serverTypeOptions = buildSimpleTypeOptions(regionTypes, { filterSharedCpu: false });
 
+  // Non-interactive plan (pure): `-yes -type` → resize every role (matrix run
+  // #10 caught the old behavior of only changing worker pools); `-yes` + bounds
+  // → cluster-autoscaler bounds only. `null` means no scripted plan matched —
+  // fall through to the interactive multiselect. See src/lib/scale-plan.js for
+  // the branch rationale (in-place resize vs. master-replace guard, phase-8
+  // bounds TODO). The user-facing logging stays here (side-effectful).
   let changes;
-  if (parsed.yes && parsed.type) {
-    // Non-interactive: `--type X` means "scale every node role to X" for
-    // parity with compose's `--type X` (which resizes the one VPS).
-    // Without this, a k8s `--type cx33` only changed worker pools and
-    // left master + supabase on the previous type — a UX inconsistency
-    // the e2e verify-scale assertion caught (matrix run #10 k8s
-    // scale: only the worker IP showed cx33 post-scale, supabase stayed
-    // cx23).
-    //
-    // Hetzner server_type changes are in-place resizes (~2 min reboot
-    // per node), so the master-replace guard below does NOT trip on
-    // legitimate type bumps — that guard fires only on userData drift
-    // (k3sToken, labels, cloud-init template), which the probe-and-replay
-    // earlier in this function already prevents. Master upgrades cause
-    // ~2 min of control-plane downtime; running under -y means the
-    // operator accepted the cost.
-    //
-    // Per-role overrides remain available through the interactive
-    // multiselect when finer control is needed.
-    changes = ['masterType', 'supabaseType', 'workerType'];
-    newValues.masterType = parsed.type;
-    newValues.supabaseType = parsed.type;
-    newValues.workerType = parsed.type;
-    // Allow --type and bounds to be combined in one invocation. CA
-    // re-patch happens regardless once changes include 'workerBounds'.
-    if (parsed.minWorkers != null || parsed.maxWorkers != null) {
-      changes.push('workerBounds');
-      if (parsed.minWorkers != null) newValues.minWorkers = parsed.minWorkers;
-      if (parsed.maxWorkers != null) newValues.maxWorkers = parsed.maxWorkers;
+  const plan = planK8sScaleChanges(parsed, envConfig);
+  if (plan) {
+    changes = plan.changes;
+    Object.assign(newValues, plan.newValues);
+    if (changes.includes('masterType')) {
+      p.log.info(
+        `Scaling all node roles (master, supabase, worker) to ${c.bold(parsed.type)} ${c.dim('(in-place resize, ~2 min downtime per node)')}`,
+      );
+    } else {
+      p.log.info(
+        `Updating cluster-autoscaler bounds: ${c.bold(
+          `min=${newValues.minWorkers ?? envConfig.minWorkers ?? DEFAULT_WORKER_MIN}`,
+        )} ${c.bold(`max=${newValues.maxWorkers ?? envConfig.maxWorkers ?? DEFAULT_WORKER_MAX}`)}`,
+      );
     }
-    p.log.info(
-      `Scaling all node roles (master, supabase, worker) to ${c.bold(parsed.type)} ${c.dim('(in-place resize, ~2 min downtime per node)')}`,
-    );
-  } else if (parsed.yes && (parsed.minWorkers != null || parsed.maxWorkers != null)) {
-    // Non-interactive bounds-only path: --min-workers and/or --max-workers
-    // without --type. We do not run Pulumi here unless minWorkers rose above
-    // the previously persisted floor (which would require new static workers
-    // to be provisioned).
-    //
-    // TODO(phase 8 follow-up): bounds-driven Pulumi changes — when
-    // minWorkers rises above the persisted floor, run Pulumi to add static
-    // workers; when minWorkers drops, leave Pulumi alone (don't reap static
-    // workers on bounds relax). For now we patch CA only; bumping min above
-    // the persisted floor will not provision new static workers until the
-    // next deploy.
-    changes = ['workerBounds'];
-    if (parsed.minWorkers != null) newValues.minWorkers = parsed.minWorkers;
-    if (parsed.maxWorkers != null) newValues.maxWorkers = parsed.maxWorkers;
-    p.log.info(
-      `Updating cluster-autoscaler bounds: ${c.bold(
-        `min=${newValues.minWorkers ?? envConfig.minWorkers ?? DEFAULT_WORKER_MIN}`,
-      )} ${c.bold(`max=${newValues.maxWorkers ?? envConfig.maxWorkers ?? DEFAULT_WORKER_MAX}`)}`,
-    );
   } else {
     changes = await p.multiselect({
       message: 'What would you like to change?',
@@ -1003,7 +988,11 @@ export async function run(args) {
     (c) => c === 'workerType' || c === 'masterType' || c === 'supabaseType',
   );
 
-  const isHA = envConfig.ha?.enabled && envConfig.secondaryRegion;
+  // isHATier(tier) is behavior-identical to `envConfig.ha?.enabled` for the k8s
+  // tier; the `&& secondaryRegion` conjunct is kept because HA cluster fan-out
+  // below also requires a configured standby region (registry predicate alone
+  // is NOT equivalent here).
+  const isHA = isHATier(parsed.tier) && envConfig.secondaryRegion;
   p.note(`Current Hetzner pricing: ${HETZNER_PRICING_URL}`, 'Cost');
 
   // 6. Require API token if infra changes (server type swap) needed
@@ -1021,11 +1010,12 @@ export async function run(args) {
   // a no-op scale that just returns) since both paths below require token.
   if (apiToken) {
     try {
-      const isHA = !!envConfig.ha?.enabled;
+      // Firewall allowlist gate uses ha-vs-not only (no secondaryRegion
+      // conjunct) — isHATier(tier) === `!!envConfig.ha?.enabled` for k8s.
       const result = await ensureOperatorIpAccess({
         projectConfig,
         environment,
-        isHA,
+        isHA: isHATier(parsed.tier),
         apiToken,
         yes: !!parsed.yes,
         onMessage: (msg) => p.log.info(msg),
@@ -1054,14 +1044,6 @@ export async function run(args) {
       );
       const { buildHetznerK8sProgram } = await import('./lib/iac/programs/hetzner-k8s.js');
       const { K3S_VERSION } = await import('./lib/deploy/k8s/k3s.js');
-      const REGION_TO_NETWORK_ZONE = {
-        nbg1: 'eu-central',
-        hel1: 'eu-central',
-        fsn1: 'eu-central',
-        hil: 'us-west',
-        ash: 'us-east',
-        sin: 'ap-southeast',
-      };
       // SSH key location depends on deploy topology:
       // - Single-cluster k8s: deployK3s' ensureSshKey writes
       //   `.vibecarbon/ssh-<env>` and lets Pulumi manage the SshKey resource.
@@ -1154,45 +1136,30 @@ export async function run(args) {
       // destructive replace. The k3sToken probe-and-replay (further below)
       // keeps userData stable; HA needed `existingSshKeyId` to also be
       // mirrored or master.sshKeys would still drift and replace etcd.
+      // Byte-identical to deployK3s' program inputs — every field that flows
+      // into a Server's sshKeys/firewallIds/labels/userData is a destructive-
+      // replace tripwire (replacing master = etcd wipe). buildProgramConfig
+      // (src/lib/scale-plan.js) owns the assembly + the region→zone map + the
+      // newValues/persisted/default `??` resolution. k3sVersion and labels MUST
+      // match deployK3s (both are interpolated into userData / resource labels).
       const allowedCidrs = (projectConfig.operatorCidrs ?? []).map((e) => e.cidr);
-      const programConfig = {
+      const programConfig = buildProgramConfig({
         projectName: projectConfig.projectName,
         environment: clusterEnv,
         sshPublicKey,
-        allowedSshIps: allowedCidrs,
-        allowedK8sApiIps: allowedCidrs,
-        // HA deploys share one Hetzner SshKey across primary + standby and
-        // pass `existingSshKeyId` so neither stack manages the resource.
-        // Single-cluster lets Pulumi own the SshKey (existingSshKeyId =
-        // undefined). Mirror whichever the deploy did or master.sshKeys
-        // changes and Pulumi replaces every node.
+        allowedCidrs,
         existingSshKeyId,
         location: clusterRegion,
-        networkZone: REGION_TO_NETWORK_ZONE[clusterRegion] || 'eu-central',
-        masterServerType: newValues.masterType ?? currentMasterType,
-        supabaseServerType: newValues.supabaseType ?? currentSupabaseType,
-        workerServerType: newValues.workerType ?? currentWorkerType,
-        // Phase 8: minWorkers/maxWorkers replace workerCount. minWorkers is
-        // what Pulumi consumes (static floor of worker servers it owns).
-        // maxWorkers is not consumed by Pulumi; it flows to the CA Deployment
-        // patch below. If the operator passed --min-workers/--max-workers
-        // we honor them; otherwise replay the previously persisted values
-        // (which are needed verbatim to keep Pulumi's plan a no-op for the
-        // worker pool when the operator is just resizing types).
-        minWorkers: newValues.minWorkers ?? envConfig.minWorkers ?? DEFAULT_WORKER_MIN,
-        maxWorkers: newValues.maxWorkers ?? envConfig.maxWorkers ?? DEFAULT_WORKER_MAX,
-        // MUST match the K3S_VERSION used by deployK3s — k3sVersion is
-        // interpolated into each server's userData (cloud-init script), so a
-        // mismatch makes Pulumi see ~userData on master/supabase/workers and
-        // tries to replace them. Replacing master = etcd wipe.
+        newValues,
+        currentMasterType,
+        currentSupabaseType,
+        currentWorkerType,
+        persistedMinWorkers: envConfig.minWorkers,
+        persistedMaxWorkers: envConfig.maxWorkers,
         k3sVersion: K3S_VERSION,
-        // MUST match the labels passed by deployK3s (src/lib/deploy/k8s/k3s.js).
-        // Mismatched labels make Pulumi mark every resource as ~labels and
-        // attempt a replace — for hcloud.SshKey, replace = delete+create with
-        // the same public-key bytes, which Hetzner rejects with HTTP 409.
         labels: { 'managed-by': 'vibecarbon', 'os-flavor': 'k3s' },
         apiToken,
-      };
+      });
 
       // Probe prior stack outputs for the k3sToken so we can replay it into
       // the real program. classifyK3sTokenProbe normalizes recovered/empty/
@@ -1388,13 +1355,7 @@ export async function run(args) {
           } catch {
             argList = [];
           }
-          const updated = argList.map((a) =>
-            typeof a === 'string' && a.startsWith('--nodes=') ? `--nodes=${caNodesSpec}` : a,
-          );
-          // If for some reason --nodes wasn't there, append it.
-          if (!updated.some((a) => typeof a === 'string' && a.startsWith('--nodes='))) {
-            updated.push(`--nodes=${caNodesSpec}`);
-          }
+          const updated = updateCaNodesArgs(argList, caNodesSpec);
           const patch = JSON.stringify({
             spec: {
               template: { spec: { containers: [{ name: 'cluster-autoscaler', args: updated }] } },
@@ -1517,31 +1478,40 @@ export async function run(args) {
     // plane has truly stabilized post-resize.
     const apiSpinner = p.spinner();
     apiSpinner.start(`Waiting for API server to be reachable (${label})`);
-    const apiStart = Date.now();
     const API_READY_BUDGET_MS = 300_000;
-    let apiReady = false;
-    let lastApiErr = '';
-    while (Date.now() - apiStart < API_READY_BUDGET_MS) {
-      try {
-        runCommand(['kubectl', '--kubeconfig', kubeconfigPath, 'get', '--raw=/healthz'], {
-          silent: true,
-          timeout: 10_000,
-        });
-        apiReady = true;
-        break;
-      } catch (err) {
-        lastApiErr = err.message?.split('\n')[0]?.slice(0, 120) || String(err).slice(0, 120);
-        await new Promise((r) => setTimeout(r, 5_000));
-      }
-    }
-    if (!apiReady) {
+    // Fixed 5s interval (backoffFactor: 1) under a 300s budget — the probe
+    // throws while the floating IP is re-attaching (runCommand rejects on
+    // nonzero exit when silent), and pollUntil retries a throwing probe.
+    // Timeout still throws (preserving the old fail-fast); we re-wrap so the
+    // operator-facing message and last-error detail are unchanged.
+    try {
+      await pollUntil(
+        () => {
+          runCommand(['kubectl', '--kubeconfig', kubeconfigPath, 'get', '--raw=/healthz'], {
+            silent: true,
+            timeout: 10_000,
+          });
+          return true;
+        },
+        {
+          budgetMs: API_READY_BUDGET_MS,
+          initialDelayMs: 5000,
+          backoffFactor: 1,
+          description: 'k8s API healthy after resize',
+        },
+      );
+      apiSpinner.stop(`API server reachable (${label})`);
+    } catch (err) {
       apiSpinner.stop(`API server (${label}) not reachable within 5 min`);
+      const cause = err.cause;
+      const lastApiErr = cause
+        ? cause.message?.split('\n')[0]?.slice(0, 120) || String(cause).slice(0, 120)
+        : '';
       throw new Error(
         `Kube API server for ${label} never returned /healthz=ok within 5 min after Pulumi resize. ` +
           `Last error: ${lastApiErr}`,
       );
     }
-    apiSpinner.stop(`API server reachable (${label})`);
     // Wait for the Hetzner CSI driver DaemonSet to register on every
     // node BEFORE checking pod-Ready. RCA from k8s-ha standby failure
     // 2026-04-28 (live cluster repro under triple-node-reboot):